Hackers exploited Sitecore zero-day flaw to deploy backdoors

Risk actors have been exploiting a zero-day vulnerability in legacy Sitecore deployments to deploy WeepSteel reconnaissance malware.

The flaw, tracked below CVE-2025-53690, is a ViewState deserialization vulnerability attributable to the inclusion of a pattern ASP.NET machine key in pre-2017 Sitecore guides.

Some prospects reused this key in manufacturing, permitting attackers with data of the important thing to craft legitimate, however malicious ‘_VIEWSTATE’ payloads that tricked the server into deserializing and executing them, resulting in distant code execution (RCE).

The flaw is not a bug in ASP.NET itself, however a misconfiguration vulnerability created by reusing publicly documented keys that have been by no means meant for manufacturing.

Exploitation exercise

Mandiant researchers, who found the malicious exercise within the wild, report that risk actors have been leveraging the flaw in multi-stage assaults.

The attackers goal the ‘/sitecore/blocked. aspx’ endpoint, which incorporates an unauthenticated ViewState discipline, and obtain RCE below the IIS NETWORK SERVICE account by leveraging CVE-2025-53690.

The malicious payload they drop is WeepSteel, a reconnaissance backdoor that gathers system, course of, disk, and community data, disguising its exfiltration as normal ViewState responses.

Mandiant noticed the execution of reconnaissance instructions on compromised environments, together with whoami, hostname, tasklist, ipconfig /all, and netstat -ano.

Within the subsequent stage of the assault, the hackers deployed Earthworm (a community tunneling and reverse SOCKS proxy), Dwagent (a distant entry device), and 7-Zip, which is used to create archives of the stolen knowledge.

Subsequently, they escalated their privileges by creating native administrator accounts (‘asp$,’ ‘sawadmin’), cached (SAM and SYSTEM hives) credentials dumping, and tried token impersonating by way of GoTokenTheft.

Persistence was secured by disabling password expiration for these accounts, giving them RDP entry, and registering Dwagent as a SYSTEM service.

Mitigating CVE-2025-53690

CVE-2025-53690 impacts Sitecore Expertise Supervisor (XM), Expertise Platform (XP), Expertise Commerce (XC), and Managed Cloud, as much as model 9.0, when deployed utilizing the pattern ASP.NET machine key included in pre-2017 documentation.

XM Cloud, Content material Hub, CDP, Personalize, OrderCloud, Storefront, Ship, Uncover, Search, and Commerce Server are usually not impacted.

Sitecore revealed a security bulletin in coordination with Mandiant’s report, warning that multi-instance deployments with static machine keys are additionally in danger.

The really helpful actions for probably impacted directors are to right away substitute all static <machineKey> values in internet.config with new, distinctive keys, and make sure the <machineKey> aspect inside internet.config is encrypted.

Typically, it’s endorsed to undertake common static machine key rotation as an ongoing security measure.

Extra data on the best way to shield ASP.NET machine keys from unauthorized entry might be discovered right here.